<!DOCTYPE html>
<html lang="en">
  <head>
    <link rel="stylesheet" type="text/css" href="/css/style.css?v=3" />
    <link rel="stylesheet" type="text/css" href="/css/fontello.css?v=2" />
    <link rel="stylesheet" type="text/css" href="/css/themes/nitter.css" />
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
    <link rel="manifest" href="/site.webmanifest" />
    <link rel="mask-icon" href="/safari-pinned-tab.svg" color="#ff6c60" />
    <link rel="search" type="application/opensearchdescription+xml" title="nitter" href="https://nitter.net/opensearch" />
    <title>billy leonard (@billyleonard): &quot;quick writeup from @ANSSI_FR on APT31 use of home routers as ORBs with IOCs:

https:&#x2F;&#x2F;www.cert.ssi.gouv.fr&#x2F;ioc&#x2F;CERTFR-2021-IOC-003&#x2F;

and here is a potential early version of their router implant that we (cc @neelmehta) found in TAG:

https:&#x2F;&#x2F;www.virustotal.com&#x2F;gui&#x2F;file&#x2F;1d60edb577641ce47dc2a8299f8b7f878e37120b192655aaf80d1cde5ee482d2&#x2F;detection&quot; | nitter</title>
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <meta property="og:type" content="article" />
    <meta property="og:title" content="billy leonard (@billyleonard)" />
    <meta property="og:description" content="quick writeup from @ANSSI_FR on APT31 use of home routers as ORBs with IOCs:

https://www.cert.ssi.gouv.fr/ioc/CERTFR-2021-IOC-003/

and here is a potential early version of their router implant that we (cc @neelmehta) found in TAG:

https://www.virustotal.com/gui/file/1d60edb577641ce47dc2a8299f8b7f878e37120b192655aaf80d1cde5ee482d2/detection" />
    <meta property="og:site_name" content="Nitter" />
    <meta property="og:locale" content="en_US" />
    <link rel="preload" type="font/woff2" as="font" href="/fonts/fontello.woff2?21002321" crossorigin="anonymous" />
  </head>
  <body>
    <nav><div class="inner-nav">
        <div class="nav-item"><a class="site-name" href="/">nitter</a></div>
        <a href="/"><img class="site-logo" src="/logo.png" /></a>
        <div class="nav-item right">
          <div class="icon-container"><a class="icon-search" title="Search" href="/search"></a></div>
          <div class="icon-container"><a class="icon-bird" title="Open in Twitter" href="https://twitter.com/billyleonard/status/1417910729005490177"></a></div>
          <a href="https://liberapay.com/zedeus"><svg class="lp" viewBox="0 0 40.6 52.3">
  <g transform="matrix(0.83,0,0,0.83,-158,-261)">
    <path d="m202.5,366c-3.1 0-5.5-0.4-7.3-1.2-1.8-0.8-3-1.9-3.8-3.3-0.8-1.4-1.1-3-1.1-4.8 0-1.8 0.3-3.7 0.8-5.8l8.3-34.8 10.2-1.6-9.1 37.8c-0.2 0.8-0.3 1.5-0.3 2.2 0 0.7 0.1 1.2 0.4 1.7 0.3 0.5 0.7 0.9 1.3 1.2 0.6 0.3 1.5 0.5 2.7 0.6l-2 8.1"/>
    <path d="m239.2 344.3c0 3.2-0.5 6.1-1.6 8.8-1 2.6-2.5 4.9-4.4 6.9-1.9 1.9-4.1 3.4-6.7 4.5-2.6 1.1-5.4 1.6-8.5 1.6-1.5 0-3-0.1-4.5-0.4l-3 11.9h-9.7l10.9-45.4c1.7-0.5 3.7-1 6-1.4 2.3-0.4 4.7-0.6 7.3-0.6 2.4 0 4.6 0.4 6.3 1.1 1.8 0.7 3.2 1.8 4.4 3 1.1 1.3 2 2.8 2.5 4.5 0.5 1.7 0.8 3.6 0.8 5.5m-23.8 13.4c0.7 0.2 1.7 0.3 2.8 0.3 1.7 0 3.3-0.3 4.7-1 1.4-0.6 2.6-1.5 3.6-2.7 1-1.1 1.7-2.5 2.3-4.1 0.5-1.6 0.8-3.4 0.8-5.3 0-1.9-0.4-3.5-1.2-4.8-0.8-1.3-2.3-2-4.3-2-1.4 0-2.7 0.1-3.9 0.4l-4.6 19.1"/>
  </g>
</svg>
</a>
          <div class="icon-container"><a class="icon-info" title="About" href="/about"></a></div>
          <form class="icon-button" method="get" action="/settings">
            <input name="referer" value="/billyleonard/status/1417910729005490177#m" style="display: none; " />
            <button type="submit"><div class="icon-container"><span class="icon-cog" title="Preferences"></span></div></button>
          </form>
        </div>
      </div></nav>
    <div class="container"><div class="conversation">
        <div class="main-thread"><div id="m" class="main-tweet"><div class="timeline-item "><div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/billyleonard"><img class="avatar" src="/pic/profile_images%2F336754759%2Fshaka_black_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/billyleonard" title="billy leonard">billy leonard</a>
                        <a class="username" href="/billyleonard" title="@billyleonard">@billyleonard</a>
                      </div>
                      <span class="tweet-date"><a href="/billyleonard/status/1417910729005490177#m" title="21/7/2021, 18:13:55">Jul 21</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">quick writeup from <a href="/ANSSI_FR" title="ANSSI">@ANSSI_FR</a> on APT31 use of home routers as ORBs with IOCs:

<a href="https://www.cert.ssi.gouv.fr/ioc/CERTFR-2021-IOC-003/">cert.ssi.gouv.fr/ioc/CERTFR-…</a>

and here is a potential early version of their router implant that we (cc <a href="/neelmehta" title="Neel Mehta">@neelmehta</a>) found in TAG:

<a href="https://www.virustotal.com/gui/file/1d60edb577641ce47dc2a8299f8b7f878e37120b192655aaf80d1cde5ee482d2/detection">virustotal.com/gui/file/1d60…</a></div>
                <p class="tweet-published">6:13 PM · Jul 21, 2021</p>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 3</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 37</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 84</div></span>
                </div>
              </div></div></div></div>
        <div id="r" class="replies">
          <div class="reply thread thread-line">
            <div class="timeline-item ">
              <a class="tweet-link" href="/ShaneHuntley/status/1417911129620185088#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/ShaneHuntley"><img class="avatar" src="/pic/profile_images%2F1354235101551357953%2FFSRODatY_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/ShaneHuntley" title="Shane Huntley">Shane Huntley<div class="icon-container"><span class="icon-ok verified-icon" title="Verified account"></span></div></a>
                        <a class="username" href="/ShaneHuntley" title="@ShaneHuntley">@ShaneHuntley</a>
                      </div>
                      <span class="tweet-date"><a href="/ShaneHuntley/status/1417911129620185088#m" title="21/7/2021, 18:15:31">Jul 21</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/billyleonard">@billyleonard</a> <a href="/ANSSI_FR">@ANSSI_FR</a> <a href="/neelmehta">@neelmehta</a></div>
                <div class="tweet-content media-body" dir="auto">“ORB” is a term I haven’t heard in a while…</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 0</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 0</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 8</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item thread-last ">
              <a class="tweet-link" href="/x0rz/status/1418170951179640840#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/x0rz"><img class="avatar" src="/pic/profile_images%2F948466032716472320%2F72zSILqD_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/x0rz" title="x0rz">x0rz</a>
                        <a class="username" href="/x0rz" title="@x0rz">@x0rz</a>
                      </div>
                      <span class="tweet-date"><a href="/x0rz/status/1418170951179640840#m" title="22/7/2021, 11:27:57">Jul 22</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">I thought it was pretty common, what's the generally referred term otherwise?</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 0</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 0</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 0</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 0</div></span>
                </div>
              </div>
            </div>
          </div>
          <div class="reply thread thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/wxs/status/1417911569124560901#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/wxs"><img class="avatar" src="/pic/profile_images%2F1462410423819542536%2FvRmp1VRh_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/wxs" title="Wesley Shields">Wesley Shields</a>
                        <a class="username" href="/wxs" title="@wxs">@wxs</a>
                      </div>
                      <span class="tweet-date"><a href="/wxs/status/1417911569124560901#m" title="21/7/2021, 18:17:16">Jul 21</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/billyleonard">@billyleonard</a> <a href="/ANSSI_FR">@ANSSI_FR</a> <a href="/neelmehta">@neelmehta</a></div>
                <div class="tweet-content media-body" dir="auto">Not enough emojis. You really need to assert your thought leader dominance Billy.</div>
                <div class="attachments media-gif"><div class="gallery-gif" style="max-height: unset; "><div class="attachment"><video class="gif" poster="/pic/tweet_video_thumb%2FE61vDbFXEAgqTsQ.jpg%3Asmall" controls="" autoplay="" muted="" loop=""><source src="/pic/video.twimg.com%2Ftweet_video%2FE61vDbFXEAgqTsQ.mp4" type="video/mp4" /></video></div></div></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 0</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 0</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 0</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 3</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-play" title=""></span> GIF</div></span>
                </div>
              </div>
            </div></div>
          <div class="reply thread thread-line">
            <div class="timeline-item ">
              <a class="tweet-link" href="/bkMSFT/status/1417912370282835971#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/bkMSFT"><img class="avatar" src="/pic/profile_images%2F972493023635558401%2FTDJ9xci1_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/bkMSFT" title="bk (Ben Koehl)">bk (Ben Koehl)</a>
                        <a class="username" href="/bkMSFT" title="@bkMSFT">@bkMSFT</a>
                      </div>
                      <span class="tweet-date"><a href="/bkMSFT/status/1417912370282835971#m" title="21/7/2021, 18:20:27">Jul 21</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/billyleonard">@billyleonard</a></div>
                <div class="tweet-content media-body" dir="auto">🚀🔭🗝🚪is that how we’re supposed to use these?</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 0</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 0</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 6</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item thread-last ">
              <a class="tweet-link" href="/wxs/status/1417921354448482304#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/wxs"><img class="avatar" src="/pic/profile_images%2F1462410423819542536%2FvRmp1VRh_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/wxs" title="Wesley Shields">Wesley Shields</a>
                        <a class="username" href="/wxs" title="@wxs">@wxs</a>
                      </div>
                      <span class="tweet-date"><a href="/wxs/status/1417921354448482304#m" title="21/7/2021, 18:56:09">Jul 21</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">You see, now there is a thought leader! The number of emojis is proportional to how big your brain is!</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 0</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 0</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 8</div></span>
                </div>
              </div>
            </div>
          </div>
        </div>
        <div class="top-ref"><div class="icon-container"><a class="icon-down" title="" href="#m"></a></div></div>
      </div></div>
  </body>
</html>